aechoterm-bin

MEDIUM

maintainer zxp19821005 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

This PKGBUILD downloads prebuilt .deb binaries from ec.cdn.nantian.com.cn, which is the CDN of Nantian (南天信息), the vendor behind Aechoterm. This is the official vendor CDN, not a random personal host, so the supply-chain risk is lower than a truly unofficial host. However, the package installs a prebuilt binary application (app.asar + native node_modules) from a Chinese commercial vendor's CDN. The binary is not reproducible, the build process is opaque, and the sha256sums provide only integrity (not authenticity) guarantees. The app.asar and bundled native node_modules are executed at runtime via electron13. There is no GPG signature verification. The vendor's GitHub org (Aechoterm/Aechoterm) exists but the binaries are served from the CDN rather than GitHub releases, making independent verification harder. This is a legitimate medium-risk pattern: executed prebuilt code from a vendor CDN with no cryptographic authenticity verification beyond a hash, which is standard for many -bin AUR packages but still represents a real supply-chain trust concern if the CDN is compromised or the vendor is malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::https://ec.cdn.nantian.com.cn/${_pkgname}_${pkgver}_arm64.deb")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads prebuilt .deb binaries from ec.cdn.nantian.com.cn, which is the CDN of Nantian (南天信息), the vendor behind Aechoterm. This is the official vendor CDN, not a random personal host, so the supply-chain risk is lower than a truly unofficial host. However, the package installs a prebuilt binary application (app.asar + native node_modules) from a Chinese commercial vendor's CDN. The binary is not reproducible, the build process is opaque, and the sha256sums provide only integrity (not authenticity) guarantees. The app.asar and bundled native node_modules are executed at runtime via electron13. There is no GPG signature verification. The vendor's GitHub org (Aechoterm/Aechoterm) exists but the binaries are served from the CDN rather than GitHub releases, making independent verification harder. This is a legitimate medium-risk pattern: executed prebuilt code from a vendor CDN with no cryptographic authenticity verification beyond a hash, which is standard for many -bin AUR packages but still represents a real supply-chain trust concern if the CDN is compromised or the vendor is malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=aechoterm-bin
    
      3_pkgname=Aechoterm
    
      4pkgver=4.0.2
    
      5_electronversion=13
    
      6pkgrel=3
    
      7pkgdesc="A free, cross-platform terminal and file management tool for accessing remote servers with SSH and SFTP protocols.(Prebuilt version.Use system-wide electron)闪令是一款免费的、跨平台的,以SSH、SFTP协议访问远程服务器的终端、文件管理工具"
    
      8arch=(
    
      9    'aarch64'
    
      10    'x86_64'
    
      11)
    
      12url="https://ec.nantian.com.cn/"
    
      13_ghurl="https://github.com/Aechoterm/Aechoterm"
    
      14license=('LicenseRef-custom')
    
      15provides=("${pkgname%-bin}=${pkgver}")
    
      16conflicts=("${pkgname%-bin}")
    
      17depends=(
    
      18    "electron${_electronversion}"
    
      19    'python'
    
      20    'nodejs'
    
      21)
    
      22options=('!strip')
    
      23source=(
    
      24    "LICENSE.html::${url}/privacy-agreement.html"
    
      25    "${pkgname%-bin}.sh"
    
      26)
    
      27source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::https://ec.cdn.nantian.com.cn/${_pkgname}_${pkgver}_arm64.deb")
    
      28source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.deb::https://ec.cdn.nantian.com.cn/${_pkgname}_${pkgver}_amd64.deb")
    
      29sha256sums=('cc65895a835817a900c9c2c4006a1738a6f2284cfa29eeb8283fd0043121931e'
    
      30            '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
    
      31sha256sums_aarch64=('58f37a6d3987648ab0097a843648aae2f1bc7085ea0df010d11d08f7930d18e3')
    
      32sha256sums_x86_64=('67d16a2e5aebb6d43ef7a4000c5991d62f49950b7aa3dcc48c978a764dd5250d')
    
      33prepare() {
    
      34    sed -i -e "
    
      35        s/@electronversion@/${_electronversion}/g
    
      36        s/@appname@/${pkgname%-bin}/g
    
      37        s/@runname@/app.asar/g
    
      38        s/@cfgdirname@/${_pkgname}/g
    
      39        s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
      40    " "${srcdir}/${pkgname%-bin}.sh"
    
      41    bsdtar -xf "${srcdir}/data."*
    
      42    sed -i -e "
    
      43        s/\/opt\/${_pkgname}\/${pkgname%-bin} --no-sandbox/${pkgname%-bin}/g
    
      44        s/Development/Utility/g
    
      45    " "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      46    find "${srcdir}/opt/${_pkgname}/resources/app/node_modules" -type d \( -name "android-*" -o -name "darwin-*" -o -name "win32-*" \) -exec rm -rf {} +
    
      47    case "${CARCH}" in
    
      48        aarch64)
    
      49            find "${srcdir}/opt/${_pkgname}/resources/app/node_modules" -type d \( -name "linux-arm" -o -name "linux-x64" \) -exec rm -rf {} +
    
      50            ;;
    
      51        x86_64)
    
      52            find "${srcdir}/opt/${_pkgname}/resources/app/node_modules" -type d -name "linux-arm*" -exec rm -rf {} +
    
      53            ;;
    
      54    esac
    
      55}
    
      56package() {
    
      57    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      58    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      59    cp -Pr --no-preserve=ownership "${srcdir}/opt/${_pkgname}/resources/app" "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      60    install -Dm644 "${srcdir}/opt/${_pkgname}/swiftshader/"* -t "${pkgdir}/usr/lib/${pkgname%-bin}/swiftshader"
    
      61    install -Dm644 "${srcdir}/opt/${_pkgname}/LICENSE"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      62    _icon_sizes=(16x16 24x24 32x32 48x48 64x64 96x96 128x128 256x256 512x512)
    
      63    for _icons in "${_icon_sizes[@]}";do
    
      64        install -Dm644 "${srcdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png" \
    
      65            -t "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps"
    
      66    done
    
      67    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      68    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      69}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2